From a256dc41880ea50b7ef5e0bead38554aa211b2a6 Mon Sep 17 00:00:00 2001 From: Anthonios Partheniou Date: Thu, 20 Aug 2026 19:09:32 +0000 Subject: [PATCH] test: fix mTLS auto-enablement unit tests --- tests/test_discovery.py | 70 +++++++++++++++++++++++++---------------- 1 file changed, 43 insertions(+), 27 deletions(-) diff --git a/tests/test_discovery.py b/tests/test_discovery.py index 2d74ce6dfcc..62745b96e64 100644 --- a/tests/test_discovery.py +++ b/tests/test_discovery.py @@ -957,23 +957,31 @@ def test_mtls_with_provided_client_cert_unset_environment_variable( with mock.patch.dict( "os.environ", {"GOOGLE_API_USE_MTLS_ENDPOINT": use_mtls_env} ): + # Clear CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE so its fallback in + # google-auth (often "true" in Cloud SDK environments) does not bypass + # certificate_config.json auto-discovery. with mock.patch.dict( - "os.environ", {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert} + "os.environ", + { + "GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert, + "CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE": "", + }, ): with mock.patch("builtins.open", m): - with mock.patch.dict( - "os.environ", - {"GOOGLE_API_CERTIFICATE_CONFIG": config_filename}, - ): - plus = build_from_document( - discovery, - credentials=self.MOCK_CREDENTIALS, - client_options={ - "client_encrypted_cert_source": self.client_encrypted_cert_source - }, - ) - self.assertIsNotNone(plus) - self.assertEqual(plus._baseUrl, base_url) + with mock.patch("os.path.exists", return_value=True): + with mock.patch.dict( + "os.environ", + {"GOOGLE_API_CERTIFICATE_CONFIG": config_filename}, + ): + plus = build_from_document( + discovery, + credentials=self.MOCK_CREDENTIALS, + client_options={ + "client_encrypted_cert_source": self.client_encrypted_cert_source + }, + ) + self.assertIsNotNone(plus) + self.assertEqual(plus._baseUrl, base_url) @parameterized.expand( [ @@ -1105,22 +1113,30 @@ def test_mtls_with_default_client_cert_with_unset_environment_variable( with mock.patch.dict( "os.environ", {"GOOGLE_API_USE_MTLS_ENDPOINT": use_mtls_env} ): + # Clear CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE so its fallback in + # google-auth (often "true" in Cloud SDK environments) does not bypass + # certificate_config.json auto-discovery. with mock.patch.dict( - "os.environ", {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert} + "os.environ", + { + "GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert, + "CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE": "", + }, ): with mock.patch("builtins.open", m): - with mock.patch.dict( - "os.environ", - {"GOOGLE_API_CERTIFICATE_CONFIG": config_filename}, - ): - plus = build_from_document( - discovery, - credentials=self.MOCK_CREDENTIALS, - adc_cert_path=self.ADC_CERT_PATH, - adc_key_path=self.ADC_KEY_PATH, - ) - self.assertIsNotNone(plus) - self.assertEqual(plus._baseUrl, base_url) + with mock.patch("os.path.exists", return_value=True): + with mock.patch.dict( + "os.environ", + {"GOOGLE_API_CERTIFICATE_CONFIG": config_filename}, + ): + plus = build_from_document( + discovery, + credentials=self.MOCK_CREDENTIALS, + adc_cert_path=self.ADC_CERT_PATH, + adc_key_path=self.ADC_KEY_PATH, + ) + self.assertIsNotNone(plus) + self.assertEqual(plus._baseUrl, base_url) @parameterized.expand( [